Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (athena.apache.org: domain of
 peter.crowther3@googlemail.com designates 209.85.219.216 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=googlemail.com; s=gamma;
        h=mime-version:sender:in-reply-to:references:date
         :x-google-sender-auth:message-id:subject:from:to:content-type;
        b=YKzVJXVFs9D1GIfjDLUgFrJ2SqxTYmFBi2k0QROxh0hNzHzeU3JxYsgrF8j17Q7MT0
         /A4vXNxkwAzduWzqygzR2RD+CE+CA3A7YTcNdZMuG5ZShVlf1iRYb+qpMl+DBQc0GF3C
         CHLB8uH1IsYz0qd3F8t8sffuGqV/nImXKppsI=
MIME-Version: 1.0
Sender: peter.crowther3@googlemail.com
In-Reply-To: <25866870.post@talk.nabble.com>
References: <485227C2.90400@ice-sa.com> <25866870.post@talk.nabble.com>
Date: Tue, 13 Oct 2009 08:12:44 +0100
Message-ID: <e0c148a0910130012s1f4e95acw93b594de41cd2f28@mail.gmail.com>
Subject: Re: SSL/HTTPS forwarding under Apache + mod_jk + tomcat
From: Peter Crowther <peter.crowther@melandra.com>
To: Tomcat Users List <users@tomcat.apache.org>
Content-Type: text/plain; charset=ISO-8859-1

[This should really be a new thread, but...]

2009/10/13 Tezza <auspakwa@hotmail.com>:
> I got 1 apache and 2 tomcat servers (all on different machines).
> I already got SSL set up on individual Tomcat machines to work on port 8443.
> There is no SSL installed on Apache.
> I got mod_jk installed on apache to forward "all" HTTP requests to tomcat
> servers for load balancing. It works fine.
>
> I like to also forward all HTTPS requests to tomcat servers.
>
> Question:
> Do I must install certificate (SSL) on apache server?

Yes.

> and remove from tomcat servers???

No need - they're not doing any harm, they just won't be used in your
environment.

> If possible: I prefer to leave SSL on tomcat servers, and just tell apache
> to forward all HTTPS to tomcats just like HTTP. My tomcat servers will
> handle the workload fine with https. Can it be done?

No.  If your clients use SSL to httpd, httpd must be able to handle
the SSL connection - mod_jk has no way of forwarding raw encrypted
data to Tomcat.  Therefore httpd must have SSL set up locally -
including the certificate.

- Peter

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org